Mexico updates anti-money laundering rules

New obligations under the LFPIORPI

Mexico’s Ministry of Finance and Public Credit published a reform to the General Rules under the LFPIORPI through Agreement 115/2026. The update adds a requirement to maintain a documented risk assessment methodology before offering new products or services, or before onboarding new customers.

The reform also requires customers to be classified by risk level as low, medium or high, with room to add intermediate tiers. Based on the materials reviewed, the risk-based approach now becomes the operational framework for obligated entities.

Methodology, review and deadlines

The new rules require companies to design and implement a methodology to identify, analyze, measure and mitigate money laundering risks. That assessment must take into account customers, transactions, products, services, channels and geographic areas, along with amounts, frequency, and the origin and destination of funds.

Piranirisk said the methodology must be set out in writing, use information covering a period of at least 12 months, and be reviewed at least every 12 months, or whenever new risks emerge or the National Risk Assessment is updated. It also said customer classification must be reassessed at least every six months.

For compliance timing, the reform takes effect on November 30, 2026. The internal policy manual and risk methodology must be updated by March 1, 2027, while automated mechanisms have until June 1, 2027.

CTW México added that the risk-based assessment must be available to the authority and that existing obligated entities must have the updated manual by March 1, 2027. Infobae, meanwhile, reported that Hacienda changed anti-money laundering rules so entities engaged in vulnerable activities must identify, assess, classify and document risks tied to customers, transactions, products, services, channels and geographic areas.

Biometric changes for banks

El Cronista also reported that the resolution promoted by SHCP and CNBV changes rules applicable to credit institutions on identity verification using biometric technology. According to that outlet, banks will have 90 business days to make the required adjustments.

The same outlet said the regulation adds facial biometrics as an official verification method, with a minimum match threshold of 90% against records from the INE, the SRE or other federal authorities.

ObsidianRISK said the rules published by SHCP in the Official Gazette on August 7, 2026, operationalize the 2025 reform to the LFPIORPI and the 2026 reform to its regulations, and establish the risk-based approach as the guiding principle for obligated entities.